Incident disclosure

In plain English

When a model behaves dangerously in testing or in use, someone has to tell the people who need to know. Incident disclosure ranges from voluntary blog posts and system card sections to legal duties. The EU AI Act requires providers of general purpose models with systemic risk to track and report serious incidents to the AI Office. New York's RAISE Act requires critical safety incidents to be reported to the state within 72 hours, or 24 hours if there is imminent risk of death or serious injury, and Illinois SB 315 sets similar deadlines.

Disclosure has an awkward incentive: labs that report more look worse. The Containment Board gives credit for disclosure itself, and the Rogue Incident Database relies on it, since most cases come from labs, institutes and researchers who chose to publish. In September 2026 California's executive order N-9-26 asked for recommendations on expanding incident reporting to loss of control incidents.

Why it matters for rogue SI

Rogue SI will not announce itself. Disclosure rules decide whether early warning signs reach the public, regulators and other labs, or stay inside one company.

Laws and rules that use it

• In force EU AI Act (GPAI) European Union
• Voluntary or guidance GPAI Code of Practice (Safety and Security) European Union
• Voluntary or guidance CAISSI United States
• Proposed FRONTIER Act United States
• In force SB 53 California
• In force EO N-9-26 California
• Passed, not yet in force RAISE Act New York
• Passed, not yet in force SB 315 Illinois

Sources

1. Guidelines for providers of general-purpose AI models European Commission · Jul 18, 2025
2. The General-Purpose AI Code of Practice European Commission · Oct 7, 2026